Endpoint Protection Manager is failing to create forward merge delta files for antivirus definitions

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection Manager (SEPM) is failing to create forward merge delta files for antivirus definitions

 

Error messages and other symptoms

• "Merge failed, ZERO BYTE DAX file" errors in SEPM ContentMergeTask logs
   
• SymDelta folders are accumulating in SEPM's service temp folder (location may vary).
  Example temp folder contents:

   Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp
  ...
  08/14/2015  11:03 AM    <DIR>          SymDelta_1092
  08/13/2015  01:42 PM    <DIR>          SymDelta_2968
  08/13/2015  01:31 PM    <DIR>          SymDelta_3144
  08/13/2015  06:19 PM    <DIR>          SymDelta_3764
  08/16/2015  11:59 AM    <DIR>          SymDelta_6368
  08/17/2015  01:32 AM    <DIR>          SymDelta_6576
  08/13/2015  06:58 AM    <DIR>          SymDelta_6684
  08/17/2015  06:19 AM    <DIR>          SymDelta_8820
  08/15/2015  12:32 PM    <DIR>          SymDelta_9808
  08/12/2015  11:01 PM    <DIR>          SymDelta_9992
  ...
   Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SymDelta_1092
  08/14/2015  11:03 AM    <DIR>          .
  08/14/2015  11:03 AM    <DIR>          ..
  08/14/2015  11:04 AM    <DIR>          xdelta150804016_To_150813035.dax.tmp
  08/14/2015  11:03 AM    <DIR>          xdelta150804016_To_150813035.dax_MERGE_.tmp
                 0 File(s)              0 bytes
   Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SymDelta_1092\xdelta150804016_To_150813035.dax.tmp
  08/14/2015  11:04 AM    <DIR>          .
  08/14/2015  11:04 AM    <DIR>          ..
  08/14/2015  11:03 AM                34 CATALOG.DAT.DIFF
  08/14/2015  11:04 AM             1,446 cur.scr
  08/14/2015  11:03 AM            20,792 ESRDEF.BIN.DIFF
  08/14/2015  11:03 AM         6,216,022 HF.DAT.DIFF
  08/14/2015  11:03 AM         2,149,802 HP.DAT.DIFF
  08/14/2015  11:03 AM         6,700,170 TCDEFS.DAT.DIFF
  08/14/2015  11:03 AM            24,929 TCSCAN7.DAT.DIFF
  08/14/2015  11:03 AM               424 TCSCAN8.DAT.DIFF
  08/14/2015  11:03 AM           113,086 TCSCAN9.DAT.DIFF
  08/14/2015  11:03 AM                42 TINF.DAT.DIFF
  08/14/2015  11:03 AM                37 TINFL.DAT.DIFF
  08/14/2015  11:03 AM                72 TSCAN1.DAT.DIFF
  08/14/2015  11:03 AM             1,110 V.GRD.DIFF
  08/14/2015  11:03 AM               322 V.SIG.DIFF
  08/14/2015  11:03 AM               322 V1.SIG.DIFF
  08/14/2015  11:03 AM             9,331 VIRSCAN1.DAT.DIFF
  08/14/2015  11:03 AM                85 VIRSCAN2.DAT.DIFF
  08/14/2015  11:03 AM               106 VIRSCAN3.DAT.DIFF
  08/14/2015  11:03 AM                57 VIRSCAN4.DAT.DIFF
  08/14/2015  11:03 AM            96,905 VIRSCAN5.DAT.DIFF
  08/14/2015  11:03 AM            36,181 VIRSCAN6.DAT.DIFF
  08/14/2015  11:04 AM         2,344,246 VIRSCAN7.DAT.DIFF
  08/14/2015  11:04 AM               562 VIRSCAN8.DAT.DIFF
                23 File(s)     17,716,083 bytes
  
  
  

Cause

This problem may occur when SEPM is installed on 32-bit machines and the forward delta generation is merging a group of smaller files whose accumulated size is greater than about 100MB. NOTE that the ZERO BYTE DAX error and temp folder accumulation may be a result of other issues; please consult Symantec Technical Support to confirm root cause.

Resolution

A workaround is to limit the delta size to something under 100MB for 32-bit operating systems:

1. Stop SEPM services
2. Add following line to %SEPM_HOME%\tomcat\etc\conf.properties:
   scm.content.delta.merge.invoke.size.limit.x86=83886080
3. Restart SEPM services.

Symantec is aware of this issue and is working on a fix to the product so that the workaround will be unnecessary. This article will be updated as new information becomes available.